Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use to have owned php scripts on a dedicated server by user "webroot".

It would be easier for coding and administration if the scripts were owned by the apache2 user, "www-data" on my system. Also feels more simple and clean.

There is no ftp on this box and there are no other users or sites.

Why not have the php scripts owned by www-data? If there is anything against it, what is the worst that can happen?

share|improve this question

4 Answers 4

up vote 0 down vote accepted

I strongly not recommend using apache user as the owner of the files for security reasons. If one of your apache php scripts is compromised it will be able to write on any file owned by apache.

You should use the ownership to apache user strictly for files that you need to be changed by php.

share|improve this answer

Sounds like you use Ubuntu (like flavor as they use the www-data user)

I would recommend always to let the apache user and group (set in httpd.conf or apache.conf) be the owner of your website files.

I prefer using apache:apache though

share|improve this answer
    
Yes, Ubuntu here. Apache is indeed a better username. –  user12096 Mar 31 '10 at 13:14

The danger is that a script or the web server could be compromised, allowing an attacker to write PHP files to your server. How realistic that threat is depends on things like if your scripts allow the uploading of files (and how well they check their file types) and what software is running. Security isn't a yes/no either/or proposition -- one typically looks for opportunities to make a server more secure in many different places. Unfortunately it is almost always the case that security is at odds with convenience.

share|improve this answer
    
The point is if the files and directories are owned by apache, php cannot write them? So the weak point is php's upload function? And what if the upload function would somehow be secured or disabled? –  user12096 Apr 26 '10 at 9:27
    
if PHP is running as mod_php, then it will be running as apache or whatever the web username is. One reason some people run PHP as a CGI, which is slower, is that you can set it to a different user. The upload is just one week point - the question is executing code you didn't intend to execute and uploading a php file and all the other scripts are running as the same user, then I can use my one script to modify the others. –  Devin Ceartas Apr 28 '10 at 0:50

The argument against having the same user own the files and run the httpd process would be that if your apache instance was compromised, the attacker could modify the files in your docroot.

Like usual, security and ease-of-use are at odds, so you'll have to make the call depending on your environment.

This article on apache and file ownership/permissions is a bit old, but the same principles still apply

http://onlamp.com/pub/a/apache/2004/05/28/apacheckbk.html

share|improve this answer
    
So this is different from Mircea Vutcovici's aspect? You say apache could be compromised (how that, isn't it ment to be secure?) and Mircea says the php scripts could be compromised? –  user12096 Apr 26 '10 at 9:25
    
I believe Mircea and I are trying to say the same thing. Even a "secure" Apache instance could be compromised by an insecure php script. –  micah May 3 '10 at 15:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.